[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	5.0.3 → 5.0.4
vite (source)	1.1.0 → 1.2.0
vite-plus (source)	1.1.0 → 1.2.0
vitest (source)	5.0.3 → 5.0.4

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.4

Compare Source

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in #​11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in #​11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in #​11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in #​11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in #​11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in #​11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in #​11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in #​11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in #​11417 (56b31)
• Fix module graph builtin externals after #​11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11491 and #​11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in #​11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in #​11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in #​11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in #​11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in #​11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in #​8339 and #​11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in #​11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in #​10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in #​11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in #​11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in #​11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in #​11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in #​11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in #​11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in #​11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in #​11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in #​11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in #​11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in #​11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in #​11540 (cd423)
• pretty-format:
  • Support boxed symbols  -  by @​lehni in #​11445 and #​11446 (eba44)
• reporters:
  • Junit to strip ANSI sequences from all XML attributes  -  by @​meganemura and Claude Opus 5.5 in #​11407 (e1a73)
• runner:
  • Don't cache failed fixture setups  -  by @​hamed-bavar in #​11237 and #​11238 (4ee66)
• typecheck:
  • Use typescript pool in toTestSpecification  -  by @​sheremet-va in #​11451 (5f273)
• ui:
  • Remove duplicate browser-open call opening two tabs  -  by @​feastyr69 in #​11356 and #​11358 (d7e13)
  • Simplify explorer filtering + fix nested tests when search matches a suite  -  by @​hi-ogawa, Hiroshi Ogawa, Codex and Claude Opus 5.5 in #​11262 (a627b)
  • Store module graph once per environment  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11421 (af903)
  • Mount index.html handler on the ui base path  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11517 (1bc24)
  • Center split pane resize handle  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11506 (e658b)
• vm:
  • Bind this to module.exports  -  by @​sheremet-va in #​11504 (b618a)

   🏎 Performance

• Reuse fsModuleCache when filtering by source  -  by @​sheremet-va in #​11428 (7ebd9)
• spy: Reset only mocks that were called or reconfigured  -  by @​johan-gorter and Claude Opus 5.5 in #​11197 (28ef9)

    View changes on GitHub

voidzero-dev/vite-plus (vite)

v1.2.0: vite-plus v1.2.0

Compare Source

Vite+ 1.2 supports authenticated private npm registries and shows a new vp run summary that counts cache hits among cache-enabled tasks and reports successful tasks. It also verifies installer downloads, shows download progress in vp upgrade, and fixes task cache misses in pnpm projects and PowerShell exit status.

Highlights

• Support authenticated private npm registries (#​2624), by @​RSS1102.
• The vp run summary now reads like 3/4 cache hit (75%), 9/10 successful, 2s saved.: the cache hit rate leaves out tasks with caching disabled, and the count of successful tasks replaces the count of failed tasks (vite-task#821), by @​wan9chi.

Features

• The install.sh and install.ps1 installers check each downloaded platform archive against the registry's SHA-512 dist.integrity before extracting it, and stop when the digest is missing or does not match (#​2949), by @​fengmk2.
• vp upgrade shows a progress bar while it downloads the new platform package, instead of looking frozen on slow connections (#​2968), by @​kshanxs.
• When a task is not cached because it wrote a file it also read, the summary says it modified its inputs, and vp run --last-details shows the cache: { input, output } exclusions that let it be cached. Detailed summaries show each cause of an error on its own line, and an invalid --filter glob reports its error once (vite-task#783, vite-task#784, vite-task#761, vite-task#763), by @​wan9chi.
• The task runner can be built without file-access tracking on additional platforms. Tasks on those platforms must configure both input and output explicitly to be cached (vite-task#829), by @​mfechner.
• Upgrade the bundled tools (#​2935, #​2977, #​2998, #​3021, #​3039), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.3 to vite@8.3.4.
  • rolldown@1.2.12 to rolldown@1.2.13.
  • tsdown@0.23.0 to tsdown@0.23.1.
  • vitest@5.0.3 to vitest@5.0.4. Vitest now turns on its on-disk caches by default, and vp test tasks run through vp run stay cacheable with them.
  • oxlint@1.87.0 to oxlint@1.88.0 and oxfmt@0.72.0 to oxfmt@0.73.0. Oxfmt now also formats TOML in Markdown code blocks and frontmatter. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check.
  • vp migrate keeps Prettier and continues the rest of the migration when the Prettier config uses a format the bundled Oxfmt cannot read, such as .prettierrc.yml.
  • oxlint-tsgolint@7.0.2003 to oxlint-tsgolint@7.0.2004. Line disable comments apply to type-aware diagnostics again (tsgolint#1271), so disable comments moved to the } as T line for v1.1.0 need to move back above the statement.
  • Projects that use @effect/tsgo should stay on v1.1.0 for now. The latest @effect/tsgo@0.52.0 supports oxlint-tsgolint@7.0.2004 but not oxlint@1.88.0, so its install-time patch step fails until @effect/tsgo adds support.

Fixes & Enhancements

• Reinstalling dependencies with pnpm, or installing them at another path, no longer causes task cache misses, and tasks that run pnpm run or pnpm exec no longer miss the cache after pnpm rechecks dependencies (vite-task#823, vite-task#824, vite-task#825), by @​wan9chi.
• On macOS, tasks with automatic file-access tracking can run Node.js single executable applications, such as pnpm 11's standalone binary, and deno compile outputs (vite-task#840), by @​wan9chi.
• Cached tasks can run scripts whose shebang names an interpreter path longer than 126 bytes (vite-task#788), by @​lifeiscontent.
• When a cache hit's outputs cannot be restored, vp run fails with an error suggesting vp cache clean instead of reporting a successful cache hit (vite-task#770), by @​wan9chi.
• vp run no longer stops every task when concurrent tasks write to a full output pipe, such as a CI log collector (vite-task#801), by @​naokihaba.
• On Linux, tasks with automatic file-access tracking start faster (vite-task#817), by @​wan9chi.
• In PowerShell, a failing vp command sets $? to False and stops && chains, as calling vp.exe directly does (#​2947), by @​fengmk2.
• The Windows installer works when the PowerShell profile enables Set-StrictMode, and leaves the caller's strict mode unchanged (#​3005), by @​fengmk2.
• Sourcing the Vite+ env script in POSIX shells is much faster with a long PATH, for example from 1.5 s to 6 ms in dash with 147 entries (#​2905), by @​jonykru.
• Node.js version ranges from .node-version, engines.node, and devEngines.runtime, and package-manager version ranges, follow npm's semver rules (#​2835), by @​ryuapp.
• vp migrate adds the tsdown <0.23 compatibility settings (deps.resolveDepSubpath and attw.profile) only for projects on an older tsdown, so upgrades from Vite+ 1.x or tsdown@0.23.0 and later keep the modern defaults (#​2910), by @​fengmk2.
• vp create vite:generator keeps the description prompt visible instead of drawing the spinner over it, uses concrete version ranges for dependencies missing from the workspace catalog, adds rootDir: "src" to the generated tsconfig.json, and scaffolds generators on bingo@0.13.2 with Zod 4 option schemas (#​2940, #​2996, #​1831), by @​jong-kyung, @​fengmk2, and @​renovate[bot].
• vp create stops processing an organization template archive that expands past fixed size, compression ratio, or entry count limits (#​2950), by @​fengmk2.
• vp config skips Git config writes that change nothing, so concurrent runs across linked worktrees no longer fail with could not lock config file after the first setup (#​2958), by @​naokihaba.
• Git hooks no longer append the legacy $VP_HOME/bin or ~/.vite-plus/bin directory to PATH. They use the inherited environment with the project's node_modules/.bin first, so projects without a local vite-plus dependency need the Vite+ bin directory on the Git client's PATH (#​2930), by @​liangmiQwQ.
• Concurrent commands that need the same uninstalled Node.js version download it once; the others wait and reuse the installation (#​3024), by @​fengmk2.
• @voidzero-dev/vite-plus-core declares the same postcss, optional fsevents, and Yuku parser ranges as the bundled Vite and tsdown, and @oxlint/plugins matches the bundled oxlint (#​2921), by @​fengmk2.
• vp pack --help lists both default env prefixes, VITE_PACK_ and TSDOWN_ (#​3002), by @​jong-kyung.
• Prompts and status lines use one space after status symbols (#​2928), by @​cpojer.

Docs

• Document shell completion, the global -C flag, the split directory layout, automatic update checks and how to opt out, package manager subcommands, and vp env doctor diagnostic scopes (#​2972, #​2956, #​2973, #​2960, #​2975, #​2982), by @​jong-kyung.
• Clarify how vp exec and vpx resolve commands, how vp test selects its runner, how vp config treats existing Git hooks, what vp check needs for type checking, and how global CLI environment variables behave (#​2957, #​2979, #​2962, #​2978, #​2916, #​2919), by @​jong-kyung.
• Correct migration prerequisites, minimum versions, and upgrade order, clarify tsup migration and staged configuration, fix local CLI installation without a global vp, and state the version requirements of vp env uninstall (#​2990, #​2923, #​2944, #​3004, #​2946), by @​jong-kyung.
• Rename the install guide to Package Management, clarify package-management command compatibility, and align the create, run, and staged guides with CLI behavior and Vite Task defaults (#​2929, #​2925, #​2939, #​2941, #​2908), by @​jong-kyung.
• Explain task cache behavior and how Vite build outputs are cached (#​2963, #​2942), by @​yusuke99 and @​jong-kyung.
• Correct the baseUrl and editor setup guidance in troubleshooting, and clarify JetBrains IDE support (#​2943, #​3001), by @​jong-kyung.
• Note that lazyPlugins does not defer local module imports (#​2967), by @​kshanxs.
• Align inline comments in code examples (#​2927), by @​yusuke99.

Chore

• Bump vite-task to 9ba4cc9; its user-facing changes are listed above (#​3019), by @​wan9chi.
• Speed up CI by removing platform waits, reusing native test binaries and dependency caches, skipping slow pnpm cache restores on macOS and Windows, and installing prebuilt cargo-zigbuild (#​2961, #​3023, #​3015, #​3010), by @​fengmk2.
• Run CI bootstrap scripts without unpinned tsx, isolate upstream CLI help capture from workspace overrides, and update security-action to v1.0.10 (#​2948, #​2976, #​3022), by @​fengmk2.
• Cache the docs build with the Vite Task remote cache (#​2926, #​2951), by @​wan9chi.
• Add a Nix flake for the contributor development environment (#​2874, #​2974), by @​myuron and @​fengmk2.
• Stabilize the CLI help wrapping and browser snapshot tests (#​2952, #​3006), by @​myuron and @​fengmk2.
• Exclude upstream-managed dependencies from Renovate (#​2918), by @​fengmk2.
• Refine the release-manager guidance (#​2917), by @​fengmk2.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.4	b6c20f6	8.3.4
rolldown	1.2.13	f7de35f	1.2.13
tsdown	0.23.1	npm	0.23.1
vitest	5.0.4	npm	5.0.4
oxlint	1.88.0	npm	1.88.0
oxlint-tsgolint	7.0.2004	npm	7.0.2004
oxfmt	0.73.0	npm	0.73.0

Upgrade

vp upgrade

New Contributors

@​ryuapp @​jonykru @​myuron @​kshanxs @​mfechner

Full Changelog: voidzero-dev/vite-plus@v1.1.0...v1.2.0

Published Packages

• @voidzero-dev/vite-plus-core@1.2.0
• vite-plus@1.2.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.2.0 vp build

Run any vp command without installing it; see the Docker guide for more.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b750545c-d790-4101-bc67-30b30bc63fdd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​voidzero-dev/​vite-plus-core@​1.1.0 ⏵ 1.2.0			+1	-1
	@​vitest/​coverage-v8@​5.0.3 ⏵ 5.0.4			+1	-1
	vitest@​5.0.3 ⏵ 5.0.4			+1
	vite-plus@​1.1.0 ⏵ 1.2.0				+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@934

commit: 2d5c5d7

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.77%. Comparing base (86bc39b) to head (2d5c5d7).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #934   +/-   ##
=======================================
  Coverage   94.77%   94.77%           
=======================================
  Files          10       10           
  Lines         746      746           
  Branches      235      235           
=======================================
  Hits          707      707           
  Misses         36       36           
  Partials        3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[fengmk2]

@copilot fix ci fail

[Copilot]

@copilot fix ci fail

The check job failed on vp dedupe --check because source-map-js was duplicated (1.2.1 and 1.2.2) in the lockfile. I ran pnpm dedupe --lockfile-only and committed the result in 2d5c5d7. I haven't re-run CI to confirm it now passes.